Kernel code in the davinci MMC host driver dereferences the data pointer without checking it for null in two branches of the IRQ handler. When a timeout or CRC error occurs and host->data is null, the function writes to a null pointer, causing a kernel panic and a complete system crash. The primary impact is a denial‑of‑service that results from the kernel rebooting or halting. The weakness is an improper null dereference (CWE‑476).

The flaw appears in the Linux kernel's mmc driver for davinci hosts. Any kernel configuration that includes the davinci MMC driver and does not contain the recent commit that guards against null pointers is vulnerable. The affected products are all distributions shipping a Linux kernel with this driver before the patch. Specific kernel versions are not listed, so administrators should verify whether their kernel contains the upstream change.

The issue is confined to machines that use the davinci MMC driver. An attacker must cause an interrupt with a null data pointer, which normally only occurs if the driver is misconfigured or faulty. The likely attack vector is an attacker triggering an MMC interrupt during a period of no data transfer, causing host->data to be null. Based on the description, such an interrupt could trigger the null dereference, leading to a kernel panic and denial‑of‑service. Because the fault occurs in kernel space, it can lead to a denial‑of‑service condition if an attacker can trigger the interrupt, but no remote code execution is described. The CVSS score is 5.5 (medium), and the EPSS score is <1%, indicating low exploitation probability; the unpatched kernel remains at risk of crashing under heavy MMC traffic or malformed interrupts. Prompt remediation is advised.